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NHTSA Resources 

► Budget(FY 2010) 

° Total appropriation: 

° Grant programs: 

° Behavioral programs: 

° National Driver Register: 

° Vehicle safety: 

° Administrative Expenses: 

► Personnel 

° Overall staffing level: 

° Grants programs: 

° Behavioral programs: 

° National Driver Register 
° Vehicle safety programs: 

° Administrative: 


$ 872,777,000 

$ 601,000,000 
$ 71,517,000 
$ 5,850,000 
$ 75,310,000 
$ 119,100,000 


617 FTE 

82 FTE 
70 FTE 
11 FTE 
283 FTE 
171 FTE 
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National Center for Statistics and Analysis 


► Several important data bases, including: 

° Fatality Analysis Reporting System (FARS): complete census of 
highway fatalities 

° Crashworthiness Data System (CDS): nationally representative 
sample of police-reported crashes, focused on crashworthiness 

° General Estimates System (GES): sample of police-reported crashes 

° Special Crash Investigations (SCI): in-depth investigations of limited 
number of crashes 

► Significant analytical capabilities support: 

° Public awareness campaigns 

° Rulemaking, research, and enforcement activities 
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Vehicle Safety Research 


► Three Areas of Focus & Key Programs: 

° Crashworthiness 

• Frontal and Side Impact, Dynamic Rollover, Child Protection, Alternative 
Energy Vehicles... 

° Crash Avoidance 

• Advanced Collision Avoidance, Intellidrive, Distraction, Alcohol... 

° Biomechanics 

• Human Injury Mechanisms, Crash Test Dummies, Injury Criteria... 

■ Prioritized based on potential for fatality/injury reductions 

D With consideration for special populations and risk scenarios 

■ Primarily focused on regulatory outcomes 

D But with some continuing component of exploratory & 
innovative "pure" research 
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Rulemaking 


• NHTSA issues Federal Motor Vehicle Safety Standards 
(FMVSS) covering many aspects of vehicle and equipment 
safety 

• Standards must be practicable, meet the need for motor 
vehicle safety (i.e., protect against unreasonable risk of 
accidents, death or injury), and be stated in objective terms 


Rulemakings prompted by 

- Data indicating specific need to address an area of risk (e.g., frontal 
or side crashes) 

- Congressional mandate 
Petition from public 
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Rulemaking (cont'd) 


• FMVSS generally contain performance standards; 
manufacturers must certify that they meet them 

• Standards supported by research on need, options, 
countermeasures, test procedures 

• Standards address specific areas of risk (e.g., rollover) and 
technologies likely to address the risk (e.g., ESC) 

• But FMVSS have not looked at broad subject areas (e.g., 
electronics and software) that are common to various 
crashworthiness and crash avoidance technologies: is 
there a need to address these broad areas? Are federal 

^standards the best method? 


Enforcement 


• Compliance with FMVSS 

- NHTSA's Office of Vehicle Safety Compliance selects vehicles 
and equipment for testing and inspection to determine 
compliance 

- Vehicles or equipment that do not comply must be recalled 

• Defect investigations 

- Vehicles or equipment that contain defects related to safety 
(i.e., they present an unreasonable risk) must be recalled 


Defect Investigation Process 


• NHTSA's Office of Defects Investigation constantly screens 
information for evidence of possible defect trends in 
particular vehicles or equipment: 

• Complaints (VOQs) from consumers (over 38,000 complaints in 
2009, and already that many in 2010) 

• Information from manufacturers (early warning data, technical 
bulletins, foreign recalls) 

• NHTSA investigates where a defect trend appears to exist, 
focusing on specific make, model, and model years showing 
trend 


Where it can demonstrate a defect and that it is safety 
related, NHTSA insists on recall 
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Defect Investigation Process (cont'd) 


• NHTSA must be able to show a significant number of 
failures that are vehicle-based and that the failures 
create an unreasonable risk 

► As with FMVSS development, defect investigations do 
not entail broad examinations of entire technological 
areas such as the electronic systems that support many 
vehicle functions 
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Recalls 


► More than 600 recalls of vehicles and equipment in an 
average year 

► About 75 percent of recalls are related to defects; the 
remainder concern compliance 

► Although only about 23 percent of recalls result from 
NHTSA investigations, those recalls account for 50 to 
60 percent of products recalled 



6 / 30/2010 


12 


Why NHTSA Sought Help from This Panel 


► Agency has done several investigations of UA in Toyota and other 
vehicles, leading to many recalls of millions of vehicles (discussed 
later) 

► However, despite several investigations of Toyota's ETC system, NHTSA 
has not been able to find a defect 


► NHTSA retained NASA to help it identify any possible defects in Toyota 
ETC system that can realistically be expected to cause UA in real-world 
use; may lead to a defect investigation 


► The ETC issue has brought to the fore two important and broader 
issues 

° Causes and possible remedies for UA generally, which is an issue affecting all 
vehicle manufacturers 

° The general need for greater attention to safety-critical electronics systems in 
vehicles 
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Why NHTSA Sought Help from This Panel 


► This year, Congress raised several questions about 
NHTSA's expertise in electronics and its resources to 
address possible electronic issues 


► Pending bills would 

° Require NHTSA to obtain and focus more resources on vehicle 
electronics 


Require NHTSA to issue standards on UA-related subjects such 
as brake override, pedal placement, transmission position 
marking, push-button ignition, EDRs, and electronic control 
systems 
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Why NHTSA Sought Help from This Panel 


► UA continues to be an issue affecting all manufacturers 
(see following slides) 

► Therefore, NHTSA enlisted aid of NAS to set up 
independent panel to: 

° Study causes of UA across the industry, and 
° Make recommendations to NHTSA about actions it should 
take to address safety of all electronic vehicle control systems 


VOQs 


Industry-Wide 
Alleged UA Complaints 
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UA VOQs 

After Manual Review 


















Alleged UA Complaint Rate per 100K 
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Today's Program 

• Known vehicle-based factors: what investigations and recalls have occurred 
with regard to vehicle-based causes of UA 

• Human factors: their role in UA and ongoing research on that subject 

• Other possible electronic causes: what NHTSA, with NASA's help, is doing 
currently to determine if flaws in Toyota ETC systems may be responsible for 
some of the UA events in those vehicles 

• Standards: current standards relevant to UA and standards under 
consideration 

• Research on electronics: activities NHTSA currently has underway related to 
vehicle electronics and areas where further research may be needed 

• Recommendations: areas where the agency desires specific 
recommendations on the subject of UA and vehicle control systems 
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Known Vehicle Causes of 
Unintended Acceleration 


Richard Boyd 

Acting Director 

Office of Defects Investigation 
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"Sudden Acceleration Incidents" 

► Definition: "Unintended, unexpected, high-power accelerations from a stationary 
position or a very low initial speed accompanied by an apparent loss of braking 

effectiveness." NHTSA, "An Examination of Sudden Acceleration," 1989 (Silver Book). 

► Characteristics: 

■ Engine power: sudden, large increase in engine power, at or near wide-open 
throttle (WOT) 

■ Brakes: allegedly ineffective (brake application often cited as initiator) 

■ Initial speed: over 90% start from stationary position or low-speed 

■ Location: most occur in parking lots, garages, driveways, car washes 

■ Operating mode: initial shift from PARK to REVERSE or DRIVE 

■ Crashes: most incidents result in crashes 

■ Drivers: older drivers over-represented 

■ Evidence: generally no problems with throttle control or brake systems 
identified in post-incident vehicle inspection or subsequent vehicle service 

► Technical summary: 

■ Evidence suggested that most SAI probably involve the driver unintentionally 
pressing the accelerator when braking was intended 

■ No mechanism for temporary, self-correcting brake failure was found to exist 




"Unintended Acceleration": A Broader Concept 


► The Silver Book's definition of "Sudden Acceleration" did not include 
all types of incidents involving unwanted engine power 

► More recently, "unintended acceleration" (UA) has been used as a 
catch-all term that is not limited to high engine power, low initiation 
speeds or allegations of brake ineffectiveness 

► Included in UA are the rare incidents involving prolonged open throttle 
events 

► However, data indicate that by far the most common incidents are still 
those involving sudden, high-power accelerations from a stationary 
position or very low initiation speed, as in parking lots and driveways, 
that also include allegations of brake ineffectiveness 


Known Vehicle Factors for UA 

► Throttle control history: 

■ Over 30 years of investigations & recalls (since 1970's) 

■ Wide variety of vehicle causes for unwanted engine power 

■ In the last 25 years: 

• 109 defect investigations, influencing 34 recalls 

• 174 recalls involving 15.6 million products 

► Vehicle Causes Identified in Investigations & Recalls: 

■ Stuck Throttle 

• Conditions that prevent or inhibit throttle return to idle when the driver releases the accelerator 

• Most of these conditions do NOT involve full engine power 

• Examples: pedal entrapment, cable binding, throttle icing, cruise control servo 

■ Self-Actuation 

• Conditions that cause the throttle to open or result in elevated idle speed 

• Most of these conditions do NOT involve sudden, full engine power 

• Examples: cruise control computer, engine control module, accelerator pedal sensor, high idle & 
engine surge conditions in heavy vehicles 

■ No defect conditions have been identified that: 

• Resulted in sudden WOT; and 

• Simultaneous loss of brake effectiveness 


Investigations for UA 



INFLUENCED RECALLS 

Subject 

INV. 

NO. 

UNITS 

RECALLED 

Vehicle 

based 

cause 

Stuck throttle 

57 

29 

9,428,000 

Self-actuation 

11 

1 

5,000 

Vehicle features related to pedal 
misapplication 

41 

4 

1,815,000 

Total 

109 

34 

11,247,000 


Observations: 


□ Stuck throttle: 

■ Most likely to result in an influenced recall (approx 50%) 

■ 85% of influenced recalls 

■ 84% of products recalled 

□ Vehicle features related to pedal misapplication: 

■ Three recalls to install brake transmission shift interlocks (BTSI) 

■ One recall to ensure adequate spacing of accelerator and brake pedals 
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Recalls for UA 



RECALLS 

PRODUCTS RECALLED 

Category 

MFR 

ODI 

Total 

MFR 

ODI 

Total 

Stuck throttle 

118 

29 

147 

4,043,000 

9,428,000 

13,471,000 

Self-actuation 

21 

1 

22 

313,000 

5,000 

318,000 

Vehicle features related to pedal 
misapplication 

1 

4 

5 

1,000 

1,815,000 

1,815,000 

Total 

140 

34 

174 

4,356,000 

11,247,000 

15,604,000 


Observations : 

• Most recalls address defects in "stuck throttle" category 

• 84% of recalls 

• 86% of products recalled 

• NHTSA influenced 20% of recalls and 72% of products recalled 

• Three Toyota recalls in 2009 & 2010: 

• All involved stuck throttle conditions - pedal entrapment & sticking pedals (internal friction) 

• 7,584,000 vehicles; almost half (48%) of total since 1985 


















Long-Duration, High-Speed Incidents 

► Rare events - require multiple conditions 

■ Defect condition must result in sustained high-power at or near 
WOT (e.g., floor mat entrapment, which occurs after pedal-to-floor acceleration) 

■ Braking capacity (braking torque vs. drive axle torque): 

• High-power engine, high initiation speed, and depleted vacuum reduce 
brake effectiveness 

• Drivers initially able to manage speed for 1-2 miles, but may not be 
able to stop 

• Brakes lose effectiveness due to over-heating => speed ft (some 
>100mph) 

■ Complex PRNDL gate design - difficulty shifting to "1ST 

■ Push-button ignition - difficulty turning engine "OFF" 


See San Diego County Sheriffs Department Incident Report 
concerning August 2009 crash in Santee, California (case no. 09056454) 
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Pedal Entrapment 
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PRNDL Gate Design 

> Drivers may attempt to shift to "Neutral" 

■ PRNDL gate design for Toyota Sequential Shift vehicles 
may not be intuitive for location of "Neutral" 

■ Drivers who successfully shift to "Neutral" may 
misinterpret ft in engine rpm and shift back to drive 










































Engine Start/Stop Switch 



Switch operation: 

□ Vehicle stationary: momentary 
press to start and stop 

□ Vehicle in-motion: must press 
and hold for at least 3 seconds 
(to avoid inadvertent shut-off) 

□ Different strategies used by 
other manufacturers 

■ Different time intervals 

■ Many included shut-off with 
multiple press (2x or 3x) 

■ Some prevent engine shutoff 
when moving (and not in PARK) 
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Countermeasures 

► Brake Transmission Shift Interlock (BTSI) 

■ Requires brake application for shift from PARK to ensure safe shift 

■ Introduced in U.S. in 1987 Audi passenger cars 

■ Implemented in 80% of new cars sold by 1992 

■ In vehicles without BTSI, approximately 70% of UA incidents occurred upon shift from 
PARK to REVERSE or DRIVE 

■ Effect on UA experience: 

• When first implemented, vehicles with BTSI experienced about a 60% drop in UA 

• Operating mode changed from P-D or P-R shifts to end-of-trip parking maneuvers in D or R 

► Brake Throttle Override (BTO) 

■ Reduces throttle opening if the accelerator and brake pedals are depressed 
simultaneously under certain conditions 

■ Ensures that braking torque is greater than drive axle torque 

■ Software implementation, only possible in ETC vehicles 

■ Each company has different implementation strategy 

• Some depend on sequence of pedal application, vehicle speed, amount of brake application 
or fixed accelerator position to trigger override 

Not a solution for all UA 
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Defects Investigation Recommendations 


► Are there practical ways to improve NHTSA's ability to find 
defects that may be based in electronic systems, particularly 
rare events where physical evidence is not apparent? 


Possible Electronic Causes 



Roger Saul 

NHTSA Vehicle Research and Test Center 


★★★★★ 



HTSA 


^ssmm 






Toyota Electronic Throttle Control (ETC) Study 


► Joint NHTSA-NASA effort 

° Specific focus on possible Toyota failure mechanisms 
leading to UA and warrant opening a defect 
investigation 

• Identified and demonstrated 

► Volpe test plan peer review ~ initiated June 22 


ETC Overall Approach 


► Meetings with outside parties 

° Manufacturers and suppliers 

° Individuals 

• Rajkumar, Gilbert, Hubing, Belt, and others 

► Complaint data analysis 

° Scope of problem (vehicle models, types of incidents) 

► Vehicle characterization testing 

► Assessment of ETC System 

° Look for flaws that may be real-world cause of UA 

► Determine whether results support opening defect investigation 
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Complaint Data Analysis 

► Vehicle Owner Questionnaires (VOQ) 

° Auto Safety Hotline, web site, US mail 

► Alleged UA consumer complaints encompass variety of situations 

° UA, aggressive cruise control resume, transmission shift surge, etc. 


Examination Past 10 Years VOQs 

(Mechanical & Electronic Throttles) 


Drilldown to Toyota UA VOQs 

No. of VOQs 

Total VOQs received from 1/1/2000 to 3/5/2010 

426,911 

UA related VOQs ID'd by key-word search 

19,269 

VOQs remaining after manual review 

11,454 

MY1998-MY2010- only 

9,698 

Toyota - only 

3,054 
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Publicity Effects of Toyota UA VOQs 


Note: Vehicle-based cause of UA from VOQ statements not confirmed by NHTSA 


3,054 Toyota VOQs by Date of Report 
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Fatal Incidents Allegedly Involving UA in 
Toyota Vehicles Since 2000 

Post Oct’09 VOQ increase due to recall publicity effect 

Vehicle-based cause of UA from VOQ statements not confirmed by NHTSA* 


90 

► 75 complaint incidents 

80 

involving fatality reported 

° 11 prior to Oct'09 70 

0 64 since Oct'09 

60 


► 93 fatalities in these events 50 

° 15 prior to Oct'09 40 

° 78 since Oct'09 

30 


*NHTSA confirmed 1 incident 
of vehicle based cause 

° Involved 4 deaths 
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h Number of Incidents a Number of Deaths 




































Fatal Incidents Allegedly Involving UA in 
Toyota Vehicles Since 2000 

Electronic vs. Mechanical Throttle 


Post Oct’09 VOQ increase due to recall publicity effect 

Vehicle-based cause of UA from VOQ statements not confirmed by NHTSA 



Yes No 

Electronic Throttle Control 


■ Number of Incidents 


■ Number of Deaths 























VOQs / 100k Vehicles 


25.0 


Camry UA VOQ Rate by Model Year 

Pre- 5-Oct-09* 
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MY 2002 - 2006 Camry UA VOQ's 
Consumer Complaints by Initiation Speed; 

Pre- 5-Oct-09 


VOQs Crashes 

(Initiation Speed) (Initiation Speed) 



Test Vehicle Characterization Effort 


► Purpose : To document vehicle features and capabilities that may 
contribute to instances of unintended acceleration 

° Conducted at NHTSA Vehicle Research and Test Center in Ohio 


► Vehicle selection 

° Gen 6 Camry designs + Gen 5 & Gen 7 
° Complaint vehicles 


Documentation & characterization 

° Electronic interrogation ~ repair history, TSB servicing, etc. 
° Brake & acceleration assessment 
° Gearshift pattern documentation 
° Pedal design and placement 
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Assessment of ETC System 
(NASA support to NHTSA) 


Mike Kirsch 

NASA Engineering and Safety Center 
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Scope 

► Determine if there are design and / or 
implementation vulnerabilities in the Toyota 
electronic throttle control (ETC) system that could 
realistically be expected to cause unintended 
acceleration (UA). 




Goal 



To Answer: 

► What specific conditions are necessary for ETC failure to occur? 

► Are those conditions evident in the reported cases to date? 

► What physical or electronic evidence does the failure produce? 

► What are the expected ranges in severity (throttle opening) and 
duration that could be caused by the failure? 


► Could the failure have any effect on other interfaces, such as 
the braking system? 
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Team Organization 


► NASA Team Leverages Broad NASA 
Engineering and Safety Center 
Network of Experts 

► Participants from: 

° Ames Research Center, CA 
° Dryden Flight Research Center, CA 
° Goddard Space Flight Center, MD 
° Johnson Space Center, TX 
° Jet Propulsion Laboratories, CA 
° Kennedy Space Center, FL 
° Langley Research Center, VA 
° Marshall Space Flight Center, AL 



► Main themes of the Study 

° System Engineering and 
Integration 

° Hardware 
° Software 

° Electromagnetic Compatibility 
° Human Factors 
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Points to Consider 



► Automotive troubleshooting is significantly different today 
than 10 years ago 

° Hundreds of thousand of lines of software code 
° Much harder to trace symptoms to physical causes 

► NASA has developed a strong systems engineering culture 
over generations to manage mission success 

° NASA Spacecraft needs to work the first time 


► NASA is applying this sound systems engineering approach 
to investigate possible ETC causes of unintended 
acceleration 


Similar to a failure investigation 
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Systems Engineering Approach 



► Study complaint symptoms and history 

► Develop understanding of how the design is supposed 
to work 

► Develop understanding of how the design might fail 

► Test for understanding 

► Develop Event Sequence Diagrams 

► Develop Fault Tree 

► Test the vehicle ETC to evaluate scenarios derived 
from the Event Sequence Diagrams and the Fault Tree 
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Path to Vehicle Testing 

► System, Hardware, and Software Engineering Analysis will lead to 
Test Scenarios for evaluation 

► Test Scenarios to be evaluated and prioritized by feasibility of the 
failure and how well the failure behavior matches reported incident 
reports 

► Test Scenarios to be conducted in the lab using bench top 
subsystem model (825) 

► Test Scenarios to be conducted on "non-complaint" vehicle at GSFC 

► Test Scenarios to be conducted in collaboration with DOTs Vehicle 
Research Test Center on other Model Years, and "complaint" 
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Final Points 

Toyota Electronic Throttle Control(ETC) 

Study 


Roger Saul 

NHTSA Vehicle Research and Test Center 


Potential Outcomes of Toyota ETC Effort 


1. Identification of possible defect that would 
warrant opening an investigation 

2. Nothing identified that would warrant opening a 
defect investigation or further inquiry 


3. Identification of areas of interest worthy of 
further review, but without linkage to real-world 
events necessary to open a defect investigation 
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Final Report 


► NASA will report to NHTSA on its findings and 
recommendations 

► NHTSA will issue a final report summarizing entire 
project and explaining its planned follow-up actions 

► Findings will inform future NHTSA Research of vehicle 
electronics, software, and emerging technologies 

► Results provided to NAS review of electronic control 
issues across the industry 


ETC Wrap-up and Recommendations 


► Goal: Assure the future safety of electronic throttle control 
system 

Recommendations 

► Broad review of electronic systems and UA 

° Are improvements needed in systems design approach regarding 
software, hardware, electronics and controls? 

► Methodology for assessing potential electronic failures & risks 

► Limitations of testing for rare events 



Human Factors Considerations: 
Unintended Acceleration & 

Pedal Errors 


Richard P. Compton 

Director Office of Behavioral Safety 
Research 


Overview 


► Human factors are a contributing factor in more than 
90 percent of all crashes 

► Human error plays a role in some UA incidents 

► Likely causes of UA-related human error 


► Current NHTSA study on pedal errors (began in 2008) 


NC Study of Pedal Errors 


Pedal Error is a known contributor to crashes, e.g.: 

► A study of 219 crashes in North Carolina's crash 
database in which the driver's foot contacted the 
accelerator rather than the brake 
° Most misapplications 

• Occurred during driving cycle - not at startup 

• Were not hurried 

° About half resulted from the driver's foot slipping from the 

brake to the accelerator (Schmidt, Young, Ayres &Wong, 1997) 
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How Common is Pedal Misapplication? 


Not known precisely, but consider: 

► Over 200 million licensed drivers 

► One trip a day = 200 million trips 

► Assume 50 brake applications per trip 


Result: 10 billion opportunities a day for error to result in misapplication 


NTSB Investigations of UA Crashes 


NTSB has investigated a number of unintended 
acceleration crashes 

► Reports include details about driving experience; 
medical, vehicle, and environmental factors 

° Between 1997 and 2008, NTSB investigated 7 unintended 
acceleration crashes 

• 1 passenger car 

• 5 buses 

• 1 fire truck 

0 In each instance, investigators determined that the crashes 
resulted from the driver's pedal error 


Recent Reports on Pedal Errors 


► In my car the brake is on the right: Pedal errors among 

older drivers (Freund, Colgrove, Petrakos & McLeod, 2007) 


° Study to assess extent specific cognitive functions contribute 
to pedal errors among older driver 

° 180 subjects drove a driving simulator 


° Suggests executive dysfunction contributes to pedal errors in 
older drivers. 
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Apparent Overrepresentation 
in Pedal Error Crashes 

Based on available literature: 

► Drivers of unfamiliar vehicles (NTSB, Pollard and Sussman, 1989) 

► Younger drivers 

• Have limited driving experience, so may be less familiar with brake 
position 

• Have not fully developed the prefrontal cortical structures that 
facilitate overriding an incorrect response (Lococo and Tucker, in press) 

► Older drivers 

° May experience age-related declines in these structures (lococo 

and Tucker, in press) 



Likely Causes of Pedal Misapplication 

► The driver correctly selects the brake 


► Variability in the processes that determine the 
trajectory and endpoint of the movement 

° Driver turning to check the side mirror or look over their 
shoulder - results in error in foot placement, particularly if the 
driver's response is forceful 


► Rarely, the driver's foot hits a point a bit to the right 
of the brake - the accelerator 
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Variability in Behavior 


► Schmidt (1989) explored the relationship between 
driver's movement control and unintended 
acceleration to determine: 

° Source of foot placement errors 

° Why a driver would fail to immediately perceive the error 

° Why a driver would persist in pressing the wrong pedal for 
several seconds or more 


Variability in Skilled Performance 
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Movement Error Research 


► Focused on arm and hand movements, but findings 
should apply to leg and foot movement 

° Larger limbs showed more trajectory variability (Langolf, Chaffin & 

Foulke, 1976) 

° Accuracy in acquiring an unseen target declined substantially 
when participants turned their heads (but not their gazes) by 
10-30°. 


Failure to Correct 


► Drivers brake successfully on a regular basis - the 
driver is confident that he or she can brake accurately, 
even without confirmatory feedback 

► Driver confidence that the foot is on the brake makes it 
difficult for the driver to detect and respond 
appropriately when the foot is actually on the 
accelerator 


► The driver is convinced that his or her foot is on the 
brake, and may "brake" more firmly, exacerbating the 
ituation 
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Possible Causes of Failure to Correct 


► Why do drivers sometimes persist in pedal errors - for 
more than a few seconds ? 

° Hypervigilance - response to an event that is 

• Strong, startling 

• Potentially life threatening 

• Must be addressed immediately 


Hypervigilance 


► Hypervigilance may result in: 

° Impaired information processing 

° Failure to recognize appropriate solutions such as turning 
the car off, putting it in neutral or applying the hand brake 

° Distraction by a variety of stimuli 

° Vacillation among a range of potential responses (Janis & 
Mann, 1977) 
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Perceptual Narrowing 


► Stress narrows attentional focus to highly relevant 
events, reducing the ability to address unlikely 

peripheral events (Weltman & Egstrom, 1966) 

► Driver ignores the odd feel of the "brake" and instead 
focuses on the more central events associated with the 
unexpected vehicle response 

► Consistent with driver perseverance in the error and 
with drivers' reports that they "just froze" 



6/30/2010 


68 


Current Work on 

Pedal Errors in Older Drivers 


► NHTSA has a study underway to explore the current 
frequency of pedal application errors in older drivers 

► Planned and initiated several years ago 


Objectives 


► Determine the extent of pedal error crashes 

► Identify groups overrepresented in these crashes - 

° Novice drivers? 

° Older drivers? 

► Identify typical situations/circumstances 
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Literature Review 

• Technical literature 

• News media reviews 

• Pedal error crashes in the US between 2000 and 2010 

• Searched for key phrases in newspapers (daily, weekly), TV and radio 
broadcast transcripts, news wire services, internet media 


• Limitations of media reviews 


• No control over which crashes were reported 

• Reports are sometimes purged from archives due to space 
limitations 


Whether a crash was reported might be influenced by other 
newsworthy events 

These crashes may be more newsworthy in some locales than others 

Not all publications provide their full text articles to Lexis-Nexis, 
America's Newspapers, and Google News 
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News Media Interim Results: Driver Age 



Figure 1. Involvement in Pedal Error Crashes by Driver Age Group (n=683). 








Interim Results: Driver Age 
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Driver Age 



6 / 30/2010 


73 

















































































Interim Results: Location 


Crash Involvement by Location 


■ Commercial Parking Lot 

■ Residential Parking lot 

□ Driveway 

□ Parking Garage 

■ On-Road (not intersection) 

■ Intersection 



Figure 3. Crash Involvement by Location (n=861). 
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Interim Results: Pre-crash Maneuver 



■ Entering parking space 

■ Leaving parking space 

■ Turning 


□ Driving in lane 

■ Slowing/stopping for traffic control device, 
pedestrians, or vehicles 

■ Startle braking following initial collision, 
loss of control of vehicle, or to avoid 
collision (moving or parked) 
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Conclusions 


► Human error is one important cause of unintended 

acceleration 

► Human performance is variable; people make mistakes 

° Pedal error is understandable 

° Failures in error detection and error correction need to be 
addressed 

► How this panel can help: 

° Address human error as a cause of UA 

° Determine whether electronic controls affect prevalence of pedal 
error 

° Make suggestions for reducing likelihood or effect of pedal error 
through (a) vehicle design, and (b) behavioral training and 
adjustment 


Government and Voluntary 
Standards as They Relate to 
Unintended Acceleration 


Nat Beuse 

Crash Avoidance Standards 
Rulemaking 
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Overview 


► Review related standards 

° US standards for Throttle Control, Brake Transmission Shift 
Interlock, Keyless Ignitions, Gear Selector 

° Provide references to related Industry and Non-US 
government standards 

► Current Activities 
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Glossary of Terms 


► Government 

0 FMVSS - Federal Motor Vehicle Safety Standard 
° CMVSS - Canadian Motor Vehicle Safety Standard 
° ECE - United Nations Economic Commission for Europe 
° EU - European Union 

► Industry 

0 SAE - SAE International 

° ISO - International Organization for Standardization 
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Standards Related to Throttle Control 


► FMVSS 124 "Accelerator Control Systems" 

° Throttle must return to idle position if there is a 
disconnection. 

° Does apply to electronic throttles 

• Disconnections may include separations of electrical connectors 
or conductors linking the accelerator pedal with the ECU and the 
ECU with the throttle actuator on the engine 

° Canadian Standard is identical. 


There is a standard in Korea but to our knowledge no other 
standards for throttle control on passenger cars. 
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Brake Transmission Shift Interlock 




Brake Transmission Shift Interlock 


► Helpful from "Park" position 

► Congress has required all light vehicles to be equipped 
with BTSI by September 1, 2010 . 

° NHTSA has placed the requirement in FMVSS 114. 

• System must function in any key position 


► To our knowledge there are no other standards for 
BTSI. 


Keyless Ignition-Push Button Start 










Standards Related to Keyless Ignitions 


► Labeling - FMVSS No.101. "Controls and displays" 

° Button must be labeled "Engine Start" or Engine Stop" 

° Manufacturers can add text or graphics to the required label. 

► Operation - FMVSS No. 114, "Theft protection and rollaway 
prevention," 

° Can not start the car without the key (theft), and 

° Key cannot be removed unless the vehicle is in Park (rollaway 
prevention). 

► Canadian Standards are identical in these provisions 


► There are applicable ISO, ECE, and EU standards. Also an 
SAE standard is under development 
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Gear Selection Control 
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Standards Related to Gear Selection 


► FMVSS No.102, "Transmission shift position sequence, starter 
interlock, and transmission braking effect." 

° Neutral must be located between forward and Reverse on passenger 
cars. 

° On steering column mounted controls movement from Neutral to 
forward is clockwise and Park is located at the end adjacent to 
Reverse. 


° Identification of shift positions, in relation to each other and the 
position selected, must be displayed in view of the driver. 


Canadian standard is identical. There is an applicable SAE standard. 
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Standards Related to Gear Selection 

► FMVSS No. 101. "Controls and displays" 


° P, R, N, D, and L are separate identifiers 
° PRNDL must be illuminated 
° Canadian Standard is identical 

° To our knowledge there are no other standards similar to this 
labeling requirement. 
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Current Activity 









Current Regulatory Activity 


► FMVSS No. 124 

° Finalizing new tests for hybrid vehicles, electric vehicles, and diesels 

► Brake Throttle Override/Smart Pedal 

° Conducting testing to determine performance differences between 
manufacturers 

° Developing test procedures 


► Keyless Ignitions 

° SAE is working on a consensus standard for the operation of keyless 
ignitions. 


Work being performed by a subcommittee of the Controls and Displays 
Committee within the Motor Vehicle Council 
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Current Regulatory 


► The agency is conducting 
research in this area. 

° We will be evaluating 
manufacturers internal 
guidelines and the 
applicable SAE and ECE 
standards 
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Summary 


► What additional steps are recommended to ensure the 
safety of throttle controls? 

► Are additional standards necessary to mitigate UA events? 

► The industry standards for foot pedals are design specific 
and very similar. Can they be made to be more 
performance based and are there significant differences 
between approaches? 


► What best practices from other sectors are applicable to 
vehicle electronics? 
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Research Activities Related to 

Electronics 


John Maddox 
Associate Administrator 
Vehicle Safety Research 


Vehicle Electronics - Research Activities 

Overview 

► Current Research Activities 

► Evolving New Activities 

► Potential Future Directions 
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Vehicle Electronics - Research Activities 


► Vehicles are already full of electronic content and 
features 

► Provides increased functionality for customer 
° Powertrain control 

° Restraints 
° Communications 
° Infotainment 


Vehicle Electronics - Research Activities 


► Migrating to Fundamental Vehicle Controls 

► Can provide increased functionality for customer 

° ABS, ESC, Brake Assist, Crash-Imminent-Braking... 

° Electronic Throttle 

° Electric Power Steering Assist, Active Steering... 



Seat Belt 
Pre-tensioner 


Heads-up 


Forward Radar Sensors 


Inter-Vehicle 
Communications 
Antenna 


Vision System 


GPS 
Ante 


Infrared Camera 


Brake Assist 


Side Camera & Radar 


Electron* 

Stability 

Control 


6/30/2010 


95 



Vehicle Electronics - Research Activities 


► Crash avoidance technologies are here & growing rapidly 

° Forward collision requires throttle & brake by wire 
° Some lane keeping systems use electric steer assist 
° All use radar and/or machine vision 
° Rely on very complex software & control strategies 


► Evolving rapidly 



Foresighted 

Driving 


1 I 

10s 

Safe Speed 
distance 


Lane 

Support 


Is 100 ms 10 ms 


Collision 

Mitigation 


Pre-Crash 












Crashes of all Severities 

2007 GES 


Vehicle Based Crash Avoidance Systems are being 
introduced, which can address a portion of Crash Scenarios 



Others 


Lane Departure Warning 
Stability Control 


Off Roadway 


25 % 


Crossing Paths 


Lane Change I Blind Spot Detection 


Rear-End 


Forward Crash Warning 
Mitigation Braking 
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Integrated Vehicle-Based Safety Systems 



► Purpose: Study effectiveness & driver 
acceptance of crash avoidance 
technologies 

► Phase 1 - Completed 

° Developed and validated prototype Light and 
Heavy Vehicles with Integrated Safety Systems 

► Phase 2 - Underway 

° On road testing - completed 

• 16 Passenger Cars & 10 Tractors 

• Measuring Driver Acceptance & Safety Benefits 


► Analyzing data and summarizing findings 

► Will inform future agency activities 



Lane-Departure Warning 
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Advanced Collision Avoidance Technologies 
(ACAT) 


► Purpose: Develop methodologies to estimate the 
benefits of new and emerging safety technologies 

► Research Questions: 

° What safety technologies are available? 

° In what situations do they work? 

° How effective are they? 

► Status: 

° Objective Tests Developed 
° Preliminary Safety Benefits Tools Completed 
° Completing Testing and Benefits Estimates 
° Initiating Second Phase 

• Add New Technologies 

• Integrate Benefits Methodologies 





TOYOTA 
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Crashes of all Severities 

2007 GES 


Communicative Crash Avoidance Systems can address 

82 % of Crash Scenarios 


Head-on Collision Avoidance 


Curve Speed Warning 
Lane Keeping 

Lane Departure Warning 
Stability Control 


Others 



Off Roadway 



y 


25% 


Crossing Paths 


Intersection Movement Assist 

Stop Sign & Signal Violation 
Warnings 



Lane change and merge 
assist 

Blind Spot Detectio n 



Rear-End 



Avoidance Braking 
Forward Crash Warning 
Mitigation Braking 
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IntelliDrive Program 


A national, multi-modal surface transportation system that features a connected 
transportation environment among vehicles, the infrastructure, and portable devices to 
serve the public good by leveraging technology to maximize safety, mobility and 

environmental performance 


V2V for 
Safety 
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.and a suite of targeted research and development 
initiatives that support cross-modal ITS solutions 















V2V - Vehicle to Vehicle Communications 


► Initial Safety Applications 

° Emergency Electronic Brake Lights 
° Forward Collision Warning 
° Blind Spot Warning 
° Lane Change Warning 
° Do Not Pass/On-Coming Crash Warning 

► Many other Safety and Mobility 
applications possible 
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V2I - Cooperative Intersection Collision 
Avoidance System (CICAS-V) 


► Stop Sign and Signal Violation 
Warning System 


► Phase 1 - Completed 

° Developed and validated prototype 

° System properly identifies impending 
violation 

° Delivers timely warning 


► Phase 2 - FOT 

Integrating into IntelliDrive V-l Roadmap 
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Interoperability & Security Infrastructure 


2-way secure 
communications 



» V2V Application Safety 

Implementing a 
Functional Safety 
Program for 
applications that may 
impact vehicle control 
systems 

» V2V Security 

Effects of both 
malicious and 
inadvertent erroneous 
data 


2-way secure 
communications 


Certificate renewals / reloads 
Certificate revocation list distribution 
Misbehavior reporting 
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Vehicle Electronics - Research Activities 


► Vehicle Communications Systems 

° What can we learn from ETC/UA to prevent similar issues on 
electronic controls for crash avoidance? 

° Data needs? 

° Research directions? 

° Regulatory requirements? 

° Enforcement methodologies? 
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Battery / Electric Vehicles 

Lithium-Ion Vehicles: HEV, PHEV, BEV (2009 -2013) 













































Vehicle Electronics - Research Activities 


► Battery / Electric Vehicles 

• By definition: "throttle by wire" 
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Vehicle Electronics - Research Activities 

► Lithium Ion safety 
° Cell level - thermal runaway 
° Pack level - overheating & venting 
° Vehicle level - charging/crash/crush 





Lithium-Ion (Li-ion) 



Thermal Runaway includes risk of overheating, 
fire, and explosion from batteries which have 
been compromised 




6 / 30/2010 


110 













































Vehicle Electronics - Research Activities 


► Battery/Electric Vehicles 

° Controls Safety 

• Monitors cell/pack health, SOC, etc 

• Communicates through CANBus 

• Always on when charging 


• Regulatory Requirements for 
Battery Controls? 

• Hardware reliability? 

• Software reliability? 





Vehicle Electronics - Research Activities 


► Vehicle Computer Security 


Vehicle Electronics - Research Activities 


► Vehicle Computer Security 

• Paper presented at an IEEE Computer Security & Privacy Conference on 
May 19 th - Kohno, Savage et al 




Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak Patel, and Tadayoshi Kohno 
Department of Computer Science and Engineering 
University of Washington 

Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, Stefan Savage 
Department of Computer Science and Engineering 
University of California San Diego 
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Vehicle Electronics - Research Activities 

► Able to "adversarially control a wide range of automotive functions and 
completely ignore driver input—including disabling the brakes, selectively braking 
individual wheels on demand, stopping the engine, and so on" 

► "Malicious Code can self-erase leaving no evidence of its presence" 






Vehicle Electronics - Research Activities 


► Vehicle Security Issues 

0 Similar considerations at FAA, FHWA, FRA,... 

° Increased consequences with Intellidrive connectivity? 


° Data needs? 

° Research directions? 

° Regulatory requirements? 

° Enforcement methodologies? 



Vehicle Electronics - Research Activities 


Vehicle Electronics Expertise 


• Aligned with activities on new technologies 

• Completely integrated into NHTSA vehicle safety 
activities 

• Must develop and integrate long-term expertise in-house 

• But be able to tap outside expertise when needed 
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Vehicle Electronics - Research Activities 


Vehicle Electronics - Potential Activities 

• Assessing and identifying data needs? 

• Electronics Functional Safety approach? 

• Driver Override / Fail-Safe approach? 

• Hardware requirements? 

• Redundancy approach? 

• Software Requirements? 

• Testing & validation approach and tools 

• Software "update" approach 



Vehicle Electronics - Research Activities 


Vehicle Electronics - Potential Activities - continued 

• Fault Detection (error codes) requirements? 

• Vehicle Security issues & requirements? 

• Enforcement of standards? 

• New test methods, equipment and facilities? 

• Other areas?. 
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Wrap-up and 
Recommendations 


John Maddox 
Associate Administrator 
Vehicle Safety Research 
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Wrap-up and Recommendations 


► NHTSA Organization & Process 

► UA 

► Standards 

► Electronic Controls 

► Recommendations 
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Wrap-up and Recommendations 

Recommendations 


► Goal: Assure the future safety of electronic throttle control 
and other electronic vehicle control functions 

° NHTSA data, research, rulemaking, and defects 
investigation activities & processes 
° Human, expertise, infrastructure, and financial resources 
required 



Wrap-up and Recommendations 


Recommendations 

° Unintended Acceleration - Have we taken the right approach?: 

• Categorizing and understanding reported events 

• Data, and analysis thereof 

• Methodology for assessing potential electronic failures & risks 

• Limitations of testing for rare events 

• New human factors considerations with electronic controls 

• Other considerations?. 
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Wrap-up and Recommendations 


Recommendations 

° Standards - need for additional or modified FMVSS? 

• Appropriateness of existing relevant design and testing standards 
(SAE, ISO, IEEE, etc.); 

• Requirements for electromagnetic compatibility (EMC) and 
electromagnetic interference (EMI); 

• Need for Software requirements, and nature thereof 

• Need for Redundancy requirements, and nature thereof 

• Are there unique enforcement consideration? 

• Other?. 
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Wrap-up and Recommendations 


Recommendations 

° Research - What research should we undertake regarding 
Vehicle Control Electronics reliability?: 

• Data needs and tools 

• Software considerations & testing methods 

• Computer hardware design & testing methods 

• Vehicle systems engineering 

• Driver Override/Fail-safe concepts 

• Best practices from other industries.... 
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Wrap-up and Recommendations 


Recommendations 

° Research - What additional Processes & Methodologies should 
we consider? 

• Applicability of Functional Safety Approach 

• Human system integration (HSI)/human factors interaction with 
electronics 

• Data mining and analysis techniques 

• Potential forensic/problem solving methods 

• Other?... 
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Wrap-up and Recommendations 


Recommendations 

° Organization - What organizational needs & resources are 
appropriate? 

• Areas of expertise 

• Methods to keep pace with rapidly changing technology 

• Required test equipment and facilities 

• Other?... 
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Wrap-up and Recommendations 


Desired Outcomes 

° Comprehensive and independent look 
° Broad assessment of electronic systems and UA 
° Review of possible sources of UA, including mechanical, human, 
and electronic 

° Examination of implications of wide adoption of electronic 
vehicle controls 

° Examination of best practices for assuring safety in other sectors 
° Recommendations as described, and others 
° Published findings, including information that could be used to 
advance the state of knowledge 
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Wrap-up and Recommendations 


Thank You 


